TridentLocker is a ransomware group known for targeting organizations that manage high volumes of regulated or third-party data, including government services and telecom providers. They have claimed breaches of multiple victims, such as TMPartner, Sedgwick, and Advantage 360, often exfiltrating sensitive data before deploying ransomware. The group employs techniques such as stolen credentials, phishing, and exploitation of unpatched software to gain initial access and move laterally within networks. Their operations are characterized by high visibility postings on their leak portal, which include detailed victim profiles and countdown timers to create public pressure.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| Various | TridentLocker |
No techniques mapped yet.
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names TridentLocker, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to TridentLocker. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy.